certmgr.msc opens the Certificates Microsoft Management Console (MMC) snap-in for the currently signed-in user. It is the right place to inspect, import, export, delete, or enroll certificates that an application uses in that user’s Windows context. Certificates belonging to the whole computer or to a Windows service require certlm.msc or an MMC console configured for the appropriate account.
What certmgr.msc opens
Windows stores certificates in logical certificate stores rather than in one ordinary folder. Running certmgr.msc opens the current-user certificate store, which PowerShell exposes as Cert:CurrentUser. The store belongs to the account that launched the command, so another user signing in to the same PC can see a different collection.
As an Amazon Associate I earn from qualifying purchases.
The MMC tree normally includes areas such as Personal, Trusted Root Certification Authorities, Intermediate Certification Authorities, and Trusted Publishers. Their contents vary with the account, computer policy, installed software, domain configuration, and certificates that have been imported or issued.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchA certificate is only useful to the identity that can access its associated private key. Therefore, choosing the correct store is not cosmetic: an application running as your user, the computer itself, and a service account can each require a different certificate location.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How to open Certificate Manager for your user
- Press Windows key+R to open the Run dialog.
- Enter
certmgr.mscand select OK or press Enter. - Expand Certificates – Current User in the left pane.
- Open the store that matches the certificate’s purpose, such as Personal > Certificates or Trusted Root Certification Authorities > Certificates.
You can also type certmgr.msc into Windows Search. If Windows cannot find the file, confirm that the command is entered exactly and that you are running a supported Windows desktop installation with the MMC components available.
certmgr.msc versus certlm.msc and MMC
The command determines the security scope. Use the following comparison before importing a certificate or troubleshooting an application that cannot find one.
| Scope | How to open it | Who normally uses the private key | Elevation and account considerations |
|---|---|---|---|
| Current user | certmgr.msc |
An application running as the signed-in user | User-level management; an administrator is not normally required for that user’s store |
| Local computer | certlm.msc, or MMC with the Computer account option |
The computer or services configured to use the machine context | Machine-wide changes commonly require an elevated session and suitable permissions |
| Specific service account | mmc.exe with the Certificates snap-in set to Service account |
A named Windows service identity | The service account must be selected explicitly; your personal store is not a substitute |
certlm.msc opens the local-computer store, represented in PowerShell as Cert:LocalMachine. A certificate placed there is available in the computer scope, subject to private-key permissions and the service or application’s identity.
Opening a computer or service certificate store with MMC
Use the MMC procedure when you need to select a computer account or a particular service account instead of the currently signed-in user.
- Press Windows key+R, enter
mmc.exe, and select OK. - Choose File > Add/Remove Snap-in.
- Select Certificates in the available snap-ins list and select Add.
- Choose one of the scopes: My user account, Service account, or Computer account.
- For a computer account, select Local computer: (the computer this console is running on), then choose Finish and OK.
- For a service account, select the service account option and identify the Windows service whose store you need to inspect, then finish the wizard and select OK.
If you are not an administrator, Windows generally limits certificate management to your own user account. A protected machine or service store may require an elevated MMC session and authorization to make changes.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Finding and inspecting a certificate
Navigate to the relevant logical store
Expand the account node, open a store, and select Certificates. Common locations include Personal for certificates issued to the user or computer, the trusted-root store for root authorities, and the intermediate-authority store for certificates that complete a trust chain.
Do not assume that the same store name has the same contents for every account. A user’s Personal store and the computer’s Personal store are separate views, even on the same device.
Recommended Free Tools
Read the certificate properties
Double-click a certificate to inspect its properties. Check the subject, issuer, validity dates, thumbprint, key presence, and usage extensions before relying on it. The issuer identifies who signed the certificate; the subject identifies the user, computer, service, or other name for which it was issued. The validity period only tells you when the certificate is time-valid, not whether the private key is accessible or the trust chain is complete.
Compare the thumbprint when you need to distinguish two entries with similar names. A thumbprint is a better identifier than the display name, which can be shared by multiple certificates or changed by an issuer.
Viewing, exporting, importing, and deleting certificates
Microsoft’s Certificates snap-in supports the core lifecycle operations directly from a certificate’s context menu. Select the certificate, open All Tasks, and choose the required operation.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Export a certificate
- Open the correct account and store in MMC.
- Right-click the certificate and choose All Tasks > Export.
- Follow the Certificate Export Wizard and choose whether the export should contain only the public certificate or the private key as well, when Windows permits that key to be exported.
- Protect any export that contains a private key with the wizard’s requested security settings and store it only where authorized.
- After exporting, verify the destination file and record the certificate thumbprint so you can identify the intended item later.
A public certificate can usually be distributed without granting the ability to authenticate as its owner. An export that includes a private key is different: anyone who obtains the key may be able to impersonate the certificate holder, depending on the certificate’s intended use and other controls.
Free tools Windows power users keep installed
One-click scans. No signup required.
Import a certificate
- Open the account and logical store that should own the certificate.
- Right-click the store’s Certificates node and choose All Tasks > Import.
- Use the Certificate Import Wizard to select the certificate file and complete the prompts.
- Confirm the destination store and scope before finishing. A user certificate imported into Current User will not automatically become available to a service running under another identity.
Delete a certificate
Select the certificate, choose All Tasks > Delete, and confirm only after checking its thumbprint, issuer, dependent application, and scope. Deleting a certificate can prevent an application from authenticating or validating a connection. Removing a root certificate can also change whether Windows and applications trust an entire issuing hierarchy.
Why a certificate can appear in more than one view
Current-user certificate stores generally inherit certificates from the local-machine stores, with the important exception of Current User > Personal. As a result, a certificate installed for the computer can appear while you browse a current-user logical view. That appearance does not necessarily mean Windows created two independent copies.
Before deleting or replacing an apparently duplicated certificate, compare its thumbprint and determine which scope supplied it. Removing a machine certificate requires the machine-store view; deleting a current-user entry does not necessarily remove the underlying machine certificate that other accounts or services use.
Using PowerShell to check the same stores
PowerShell provides a scriptable view of the stores. The provider paths correspond to the MMC scopes:
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Cert:CurrentUser— the signed-in user’s certificate stores.Cert:LocalMachine— the computer-wide certificate stores.
For example, Get-ChildItem Cert:CurrentUser lists the top-level stores for the current account, while Get-ChildItem Cert:CurrentUserMy lists certificates in that account’s Personal store. Use the equivalent Cert:LocalMachine path when diagnosing a machine or service configuration, and remember that the PowerShell session’s identity still controls what it can read or change.
Certificate enrollment and renewal in Active Directory environments
In an Active Directory Certificate Services deployment, the Personal store may offer All Tasks > Request New Certificate. Depending on the enrollment policy and permissions, the same area can expose renewal with a new key or scenario-specific renewal using the existing key.
Those commands are not guaranteed on every Windows installation. They depend on an available enrollment policy, certificate templates, account permissions, and the account scope selected in MMC. If the request option is missing, first verify that the computer or user is connected to the expected domain and that an issuing policy and eligible template are available.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Security precautions for trusted roots and private keys
Changing Trusted Root Certification Authorities
The Trusted Root Certification Authorities store contains trust anchors. Importing an unexpected root can make Windows and applications trust certificates that would otherwise fail validation; deleting an expected root can break secure connections. Microsoft cautions that an incorrect root-store change can compromise system security.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsBefore importing or deleting a root, verify the issuer, expected purpose, thumbprint, certificate chain, authorization, and intended scope. Do not accept a root certificate merely because a website, email, or installer requests it.
Best Value
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Protecting private keys
Store scope and private-key access must match the process identity. A certificate visible in your user store may still be unusable by a service. Conversely, moving a private-key certificate into the machine store broadens the set of processes that may be able to use it, subject to Windows key permissions. Use an elevated session only when the operation genuinely requires machine or service scope, and limit exported private-key files to authorized administrators.
Troubleshooting common problems
The certificate is not listed
- Confirm whether the application runs as your user, the local computer, or a service account.
- Open the matching scope instead of relying on
certmgr.mscalone. - Check the relevant logical store, especially Personal versus a trust store.
- Compare the certificate’s validity dates and intended usage extensions.
A service cannot use a certificate that you can see
Open MMC with the Certificates snap-in configured for that service account or the local computer, depending on how the service is configured. A certificate in Current User belongs to your logon identity and is not automatically available to the service. The service also needs permission to use the associated private key.
Two entries look identical
Compare thumbprints, issuers, validity periods, and account scope. One entry may be inherited from the local-machine store rather than being a second independent certificate. Do not delete either item until you know which identity and application depend on it.
An import or deletion is blocked
The account may lack permission for the selected store, or the operation may require an elevated MMC session. If you are not an administrator, manage the user store or ask an authorized administrator to perform the machine or service-account change.
CertMgr.exe is a different tool
The Windows SDK includes a command-line utility named CertMgr. Microsoft describes it as a tool for managing certificates, certificate trust lists (CTLs), and certificate revocation lists (CRLs), with currentUser and localMachine system-store locations. This SDK utility is separate from the certmgr.msc command that launches the graphical MMC snap-in. Installing or invoking one does not mean you have opened the other.
Quick Recap
Practical decision checklist
- Choose
certmgr.mscwhen the consuming application runs as the signed-in user. - Choose
certlm.mscwhen the certificate belongs to the computer context. - Configure MMC for a service account when a named Windows service owns the certificate.
- Inspect the thumbprint, issuer, dates, key presence, and usage before exporting, importing, or deleting.
- Treat root-store changes and private-key exports as security-sensitive operations.
- Account for local-machine inheritance when the same certificate appears in more than one current-user view.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
